Re: Is MathML really Dangerous?

--047d7b8742ccbc03d405261a5efc
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

MathML is a spec, not an implementation. The main security issues arise due
to the implementations. It is sort of like asking, "is HTML safe"? There
are some potential security vulnerabilities in the HTML spec due to links,
etc, but the main security issues depend on the implementation. Is Chrome
safe? Safrari? Firefox? IE? Given that they keep putting out security
patches, the answer is almost certainly "none is 100% safe."

As Paul Topping noted, the Chrome team found a *potential *security problem
in the MathML implementation (in WebKit) and yanked MathML. Safari just
fixed the problem and kept MathML in their browser. It had nothing to do
with a vulnerability in the spec, it was an implementation detail.

Paul Libbrecht already noted that appendix B of the spec (
http://www.w3.org/TR/MathML3/appendixb.html) lists some potential
vulnerabilities. These really don't differ from HTML vulnerabilities with
the exception that doing a computation with them exposes you to the
vulnerabilities of the computation system you use.

Neil Soiffer
Senior Scientist
Design Science, Inc.
www.dessci.com
~ Makers of MathType, MathFlow, MathPlayer, MathDaisy, Equation Editor ~



On Fri, Dec 4, 2015 at 2:04 PM, Paul Libbrecht <[email protected]> wrote:

> Moritz,
>
> Can an answer be read from the Media-Type registration's "Security
> Concerns":
>     http://www.w3.org/TR/MathML3/appendixb.html
>
> >From there, one can probably read what can be removed to make MathML saf=
e:
> - remove anything that includes external content (e.g. DTD things, styles=
,
> images, annotations),
> - do not compute with it (or remove MathML-Content),
> - remove foreign content (anything outside the MathML namespace and
> probably all annotations).
>
> This has been validated by readers of the ietf-media-type mailing-list, I
> believe.
>
> I'll note that the same requirement has been expressed for MathML to be
> considered by the ClipOps spec https://w3c.github.io/clipboard-apis/
> which is still in draft.
>
> Are we not able to write a note that demonstrates such a security?
>
> Paul
>
> Physikerwelt <[email protected]>
> 4 d=C3=A9cembre 2015 19:04
> Dear W3C Math WG,
>
> I wonder if there is a resilient security assessment for MathML. It
> would be nice, if there was at least a subset of MathML, for which the
> security was proven according to state-of-the-art of science and
> technology. For example I could imagine that only presentation MathML
> without a finite list of possible dangerous elements such as maction
> or annotation could be the secure MathML subset.
>
> The background of my question is that the Wikimedia Foundation
> considers opening the POST endpoint for converting several input
> formats (i.e. TeX, AsciMathML, and MathML) to MathML + SVG (+ PNG) [1]
> for the public[2].
> Currently this conversion endpoint it is only accessible from within
> the Wikimedia Foundation cluster and only accepts texvc* input.
>
> Best
>
> Moritz Schubotz
>
> [1]
> https://en.wikipedia.org/api/rest_v1/?doc#!/Math/post_media_math_check_ty=
pe
> if you try this link you=E2=80=99ll get a =E2=80=9CThis client is not all=
owed to use
> the endpoint=E2=80=9D exception rather than the security checked texvc ou=
tput
> you receive in the unstable demo here
>
> http://math.beta.wmflabs.org:7231/math.beta.wmflabs.org/v1/?doc#!/Math/po=
st_media_math_check_type
>
> [2] https://phabricator.wikimedia.org/T116147
>
> *) texvc is a well-defined subset of LaTeX with some custom macros.
>
>
>

--047d7b8742ccbc03d405261a5efc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">MathML is a spec, not an implementation. The main security=
 issues arise due to the implementations. It is sort of like asking, &quot;=
is HTML safe&quot;? There are some potential security vulnerabilities in th=
e HTML spec due to links, etc, but the main security issues depend on the i=
mplementation. Is Chrome safe? Safrari? Firefox? IE? Given that they keep p=
utting out security patches, the answer is almost certainly &quot;none is 1=
00% safe.&quot;<br><br>As Paul Topping noted, the Chrome team found a <i>po=
tential </i>security problem in the MathML implementation (in WebKit) and y=
anked MathML. Safari just fixed the problem and kept MathML in their browse=
r. It had nothing to do with a vulnerability in the spec, it was an impleme=
ntation detail.<br><br><div>Paul Libbrecht already noted that appendix B of=
 the spec (<a href=3D"http://www.w3.org/TR/MathML3/appendixb.html" target=
=3D"_blank">http://www.w3.org/TR/MathML3/appendixb.html</a>) lists some pot=
ential vulnerabilities. These really don&#39;t differ from HTML vulnerabili=
ties with the exception that doing a computation with them exposes you to t=
he vulnerabilities of the computation system you use.<br><br>Neil Soiffer<b=
r>Senior Scientist<br>Design Science, Inc.<br><a href=3D"http://www.dessci.=
com">www.dessci.com</a><br>~ Makers of MathType, MathFlow, MathPlayer, Math=
Daisy, Equation Editor ~<br><br><br></div></div><div class=3D"gmail_extra">=
<br><div class=3D"gmail_quote">On Fri, Dec 4, 2015 at 2:04 PM, Paul Libbrec=
ht <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]" target=3D"_bl=
ank">[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_=
quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1=
ex">

<div bgcolor=3D"#FFFFFF" text=3D"#000000">Moritz,<br>
<br>
Can an answer be read from the Media-Type registration&#39;s &quot;Security=
=20
Concerns&quot;:<br>
=C2=A0=C2=A0=C2=A0 <a href=3D"http://www.w3.org/TR/MathML3/appendixb.html" =
target=3D"_blank">http://www.w3.org/TR/MathML3/appendixb.html</a><br>
<br>
&gt;From there, one can probably read what can be removed to make MathML=20
safe:<br>
- remove anything that includes external content (e.g. DTD things,=20
styles, images, annotations),<br>
- do not compute with it (or remove MathML-Content),<br>
- remove foreign content (anything outside the MathML namespace and=20
probably all annotations).<br>
<br>
This has been validated by readers of the ietf-media-type mailing-list, I
 believe.<br>
<br>
I&#39;ll note that the same requirement has been expressed for MathML to be=
=20
considered by the ClipOps spec <a href=3D"https://w3c.github.io/clipboard-a=
pis/" target=3D"_blank">https://w3c.github.io/clipboard-apis/</a>=20
which is still in draft.<br>
<span>

</span><br>
Are we not able to write a note that demonstrates such a security?<br>
<br>
Paul<br>
<blockquote style=3D"border:0px none" type=3D"cite">
  <div style=3D"margin:30px 25px 10px 25px"><div style=3D"width:100%;border=
-top:1px solid #edeef0;padding-top:5px">   <div style=3D"display:inline-blo=
ck;white-space:nowrap;vertical-align:middle;width:49%">
   	<a href=3D"mailto:[email protected]" style=3D"color:#737f92!importan=
t;padding-right:6px;font-weight:bold;text-decoration:none!important" target=
=3D"_blank">Physikerwelt</a></div>   <div style=3D"display:inline-block;whi=
te-space:nowrap;vertical-align:middle;width:48%;text-align:right">     <fon=
t color=3D"#9FA2A5"><span style=3D"padding-left:6px">4=20
d=C3=A9cembre 2015 19:04</span></font></div>    </div></div><div><div class=
=3D"h5">
  <div style=3D"color:#888888;margin-left:24px;margin-right:24px"><div>Dear=
 W3C Math WG,<br><br>I
 wonder if there is a resilient security assessment for MathML. It<br>would
 be nice, if there was at least a subset of MathML, for which the<br>securi=
ty
 was proven according to state-of-the-art of science and<br>technology.=20
For example I could imagine that only presentation MathML<br>without a=20
finite list of possible dangerous elements such as maction<br>or=20
annotation could be the secure MathML subset.<br><br>The background of=20
my question is that the Wikimedia Foundation<br>considers opening the=20
POST endpoint for converting several input<br>formats (i.e. TeX,=20
AsciMathML, and MathML) to MathML + SVG (+ PNG) [1]<br>for the=20
public[2].<br>Currently this conversion endpoint it is only accessible=20
from within<br>the Wikimedia Foundation cluster and only accepts texvc*=20
input.<br><br>Best<br><br>Moritz Schubotz<br><br>[1]=20
<a href=3D"https://en.wikipedia.org/api/rest_v1/?doc#!/Math/post_media_math=
_check_type" target=3D"_blank">https://en.wikipedia.org/api/rest_v1/?doc#!/=
Math/post_media_math_check_type</a><br>if
 you try this link you=E2=80=99ll get a =E2=80=9CThis client is not allowed=
 to use<br>the
 endpoint=E2=80=9D exception rather than the security checked texvc output<=
br>you
 receive in the unstable demo here<br><a href=3D"http://math.beta.wmflabs.o=
rg:7231/math.beta.wmflabs.org/v1/?doc#!/Math/post_media_math_check_type" ta=
rget=3D"_blank">http://math.beta.wmflabs.org:7231/math.beta.wmflabs.org/v1/=
?doc#!/Math/post_media_math_check_type</a><br><br>[2]
 <a href=3D"https://phabricator.wikimedia.org/T116147" target=3D"_blank">ht=
tps://phabricator.wikimedia.org/T116147</a><br><br>*) texvc is a=20
well-defined subset of LaTeX with some custom macros.<br><br></div></div>
</div></div></blockquote>
<br>
</div>
</blockquote></div><br></div>

--047d7b8742ccbc03d405261a5efc--